| Age | Commit message (Collapse) | Author |
|---|
|
Compression errors from libz don't set errno.
OK mlarkin@
|
|
Was added about 4 years ago, but hasn't been used and linked into
the build. Discussed with dlg@ and mlarkin@.
mlarkin@: "Let's remove for now..."
|
|
Error messages related to bad configuration were not flushing to
stderr.
OK mlarkin@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
all files. Now RRDP has a weak sync mechanism and therefor not all
unreferenced files can be removed, instead look at the list of removes
which were part of the delta processing and remove those files.
Warn and keep the file if a delta specifies to remove a file which is
actually still referenced.
OK benno@
|
|
no capability was sent to the peer (this happens if the multiprotocol
capability got disabled). It is possible that local and remote systems end
up with no shared AFI/SAFI pair. In this case the connection will not send
or should not receive any UPDATE messages.
The previous behaviour of falling back to AID_INET in that case can result
in problematic behaviour when sessions are missconfigured.
OK benno@, deraadt@
|
|
the various JSON object that have time values.
OK benno@
|
|
bind. The len argument is modified by addr2sa but is also used as argument
in the call and it is undefined if the value of len in connect is set to
the value "returned" by addr2sa().
Should fix connect issues seen on Linux system.
OK denis@
|
|
r1.39. Issue originally reported by Anton Kasimov via rob@.
OK claudio@
|
|
OK deraadt@
|
|
"sure" mlarkin@
|
|
This adds support for front-ending httpd(8) with a TLS-terminating
gateway like relayd(8) that forwards unencrypted http traffic.
Previously httpd(8) would use a full URL in the Location header in 301
redirects when a user-agent requests a directory but without the
trailing '/'. If the user-agent originally connected with https, this
caused the redirected url to be http.
This change conforms to RFC7231 section 7.1.2.
Reported by Vincent Lee.
OK claudio@
|
|
|
|
|
|
OK job@
|
|
check needs to be done for iBGP sessions but not for eBGP sessions.
On conflict log an error and send a notification with ERR_OPEN_BGPID
suberror.
Reported by cjt (melissa_cjt at 163.com)
OK benno@
|
|
The right suberror is ERR_UPD_NEXTHOP.
Reported by cjt (melissa_cjt at 163.com)
OK benno@
|
|
Adds queue-based tracking of waiting client state to fix the cause of
state corruption when a vmctl(8) user cancels a wait and restarts it.
The socket fd value for the control process client was being used to
track the waiting party, but this also prevented multiple waiting
clients.
This moves all the state tracking of who to notify of a vm's stopping
to the control process and no longer requires the parent process to
track it in the global environment state.
Future work will be needed to smooth out the difference between the
IMSG_VMDOP_TERMINATE_VM_{EVENT,RESPONSE} events instead of needing to
translate before relaying to the vmctl(8) client.
Tested by Mischa Peters (thanks!)
ok mlarkin@
|
|
capabilities" for a session. Especially the multiprotocol capability
can confuse because both sides need to allow a protocol to enable it.
The JSON code dumps all the capabilities for local, remote and negotiated.
OK denis@, sthen@
|
|
|
|
non-existant peer; the bgpctl command exposes the error itself
ok claudio
|
|
Add protections against guests with bad virtio-{blk,net,scsi}
drivers, specifically avoiding invalid descriptor chains and
invalid vionet packet sizes. This helps prevent possible lockup
of the host vm process due to a spinning device event loop thread.
Also fix an unneeded cast in the vioblk handling in case of invalid
buffer lengths.
OK mlarkin@
|
|
|
|
|
|
|
|
|
|
|
|
This might be added back in a future if copying events to userland becomes
a performance issue. However note that it is not always possible to filter
in-kernel if, for example. a variable has to be evaluated when a rule fires.
|
|
Because dhcpsz was an uninitialized ssize_t, it was possible that a
garbage "packet" would be queued on the receiving end of the virtio
network device.
Change the type to size_t and add proper checks based on it being
greater than zero. Remove the cast of ssize_t to uint64_t that also
caused garbage sizes when dhcpsz was unintialized and set at runtime
to something < 0.
|
|
|
|
Stop using in-kernel filtering for the moment except for not tracing the
tracer.
Keep track of the number of filtered events.
|
|
|
|
|
|
Every rule gets its own list of (local) variables.
|
|
|
|
Remove '-p' option now that scripts can filter by pid/tid.
|
|
"shift" consistently. Merge the two offset loops in client_update()
into one. Use a simple assignment for the best value instead of
memcpy(). Use the same mechanism to loop over the offset array
everywhere to avoid an invalid best value.
tested by weerd@; OK claudio@
|
|
Instead add a logx when a fallback from delta sync to a snapshot happens.
|
|
to warn a 2nd time here, it adds no additional information.
|
|
ok tb@ millert@
|
|
These priv-sep daemons all follow a similar design and use TAILQs
for tracking control process connections. In most cases, the TAILQs
are initialized separate from where they are used. Since the scope
of use is generally confined to a specific control process file,
this commit also removes any extern definitions and exposing the
TAILQ structures to other compilation units.
ok bluhm@, tb@
|
|
Requests are split away from connections. When a request is received try
to reuse an IDLE connection. If none is around start a new one (unless
there are too many connections inflight).
Idle connections are kept for 10sec and closed after that time. For
rpki-client this is plenty of time since RRDP exchanges will be a burst
of requests. So the connection used to fetch the notification XML file
will be reused to fetch all delta XML files.
This reduces the CPU load since far less TLS handshakes need to happen.
OK job@ deraadt@
|
|
OK job@
|
|
|
|
tail pointer (pointer to last element) around and depending on the state
of the list insert at head or insert after tailp. Now gcc has a hard time
to realize that the tail pointer is not used uninitalized. So rewrite the
code to be more explicit about tailp handling (also rename the pointer
to be more explicit). All in all this should be more readable and silences
the gcc warning as well.
|
